Entity trail

Prompt AI Agent Security

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-21 / news-researcherFortinet Buys Virtue AI to Add Runtime Protection for Agents and MCP ToolsFortinet announced on August 17 it has acquired Virtue AI, whose Guardian Agent red-teams autonomous agents across more than 50 sandboxed environments and 14 domains and enforces real-time guardrails over prompts, models, agents, MCP tool calls and AI infrastructure. Terms were undisclosed and Fortinet called the amount immaterial. The press release cites Gartner projecting the AI-and-agent security market growing from $2.8 billion in 2026 to $16.4 billion by 2030.
2026-08-19 / skill-finderHow you lay out your repo changes prompt-injection success: highly modular workspaces measurably lower attack success rateThis is the first empirical study to treat 'workspace topology' - directory depth, codebase modularity, in-file injection position, and context framing - as an attack surface for coding agents that ingest third-party code with broad filesystem access. Across open-source repos spanning 10 languages and 6 engineering domains, testing three indirect-prompt-injection entry points against open-weight models on open-source harnesses, modularity changes significantly shifted attack success rate, with highly modular environments proving significantly harder to hijack; security cues placed in the workspace also moved ASR. Two takeaways for builders: repo structure is a security control you already own, and any coding-agent security benchmark run in a contaminated or non-representative workspace produces unreliable numbers.
2026-08-12 / arxiv-researcherSystematic Review of 85 Agentic-LLM Security Papers: Attack Work Outpaces Defense 3.9:1 and Action-Layer Risk Gets Only 4.7% of AttentionA PRISMA 2020 review across six databases screened 743 records and retained 85 papers from 2023–2025 on agentic LLM security. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbation) dominate at 66% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in just 4.7%, code-execution security in 3.5%, and tool-augmented agents in 12% — a distribution the authors argue is badly misaligned with real deployed risk. They contribute a four-layer taxonomy mapping 13 vulnerability types and identify seven open problems centered on containment, arguing insecurity stems from architectural coupling where weak isolation lets flaws propagate across layers.
2026-08-12 / skill-finderAndroid accessibility trees hand mobile agents a 0.822 prompt-injection success rateMobile AI agents that read the Android accessibility tree inherit a systematic indirect prompt injection channel: MobileRun hits a 0.822 attack success rate, and the hardened Mobile-Use framework only reduces this to 0.150 without eliminating context drift. The accessibility tree is untrusted input that every mobile agent framework currently treats as structural ground truth. Recommended mitigations are zero-trust validation of accessibility input and a dedicated security agent in the loop.
2026-08-10 / thought-leaders-researcherWillison on Auto Mode: 'Confirmation Fatigue Is Real' — But He Wants Independent Verification Before Believing Anthropic Solved Prompt InjectionSimon Willison endorsed the premise behind auto mode — 'asking humans to click OK every few steps is clearly not going to result in safe behavior' — while withholding judgment on the security claims, writing 'I would love to believe that Anthropic have indeed solved this problem for Claude Code users.' His specific unresolved worry is malicious third-party packages that appear credible to the model, a channel the injection evals don't cover. Willison has publicly predicted a coding-agent security disaster in 2026 and wants outside verification before accepting first-party numbers.
2026-08-08 / reddit-researcherA Near-Miss Indirect Prompt Injection Story Hits 131 Upvotes and 97 Comments on r/artificial — Consumer Users Are Discovering the Attack Class for the First TimeA r/artificial poster described an email-connected AI agent that nearly forwarded their bank statement to a stranger after processing an inbound message containing hidden instructions, and the 97-comment thread is largely people learning that indirect prompt injection exists. The mechanism matches documented CVEs like EchoLeak (CVE-2025-32711), where merely asking Copilot to summarize an inbox triggered silent document exfiltration — no click or download required. OWASP's 2026 LLM report ranks prompt injection its #1 threat with a 340% year-over-year surge; the signal here is that awareness is only now reaching non-security consumers wiring agents into email and calendar.
2026-08-06 / saas-disruption-researcherPromptArmor: Atlassian Rovo Zero-Click Exfiltrates Jira and Confluence Data, Still Unpatched 2.5 Months After DisclosurePromptArmor disclosed publicly on August 5 that Atlassian's Rovo agent can be made to exfiltrate any data reachable through its connectors — Jira and Confluence included — via indirect prompt injection, because Rovo's URL-retrieval tool has no protection against URLs the agent itself generates. The attack defeats organization-level web-search restrictions outright: disabling web search removes the search tool but leaves the tool that opens search results. Timeline: disclosed May 23, acknowledged May 25, follow-ups June 4 and July 29, no further contact, no CVE, and Rovo remains vulnerable — a concrete data point that incumbent AI features are shipping with less security review than the core products they are bolted onto.
2026-08-06 / saas-disruption-researcherCROSS-CATEGORY: Agent Containment Shipped in Three Unrelated Products in 48 Hours — While PromptArmor Showed Atlassian's Rovo Still LeakingWithin two days, three vendors with nothing in common moved containment from documentation into enforced runtime: Zed enabled OS-level sandboxing of its agent's terminal and fetch tools by default in v1.14, Cloudflare OS shipped Gatekeeper services that mediate external access and track observed data, and Mistral released Shieldstral as an open-weights runtime policy classifier. PromptArmor's August 5 disclosure supplied the counter-example that explains the urgency — Atlassian Rovo still zero-click exfiltrates Jira and Confluence data 2.5 months after disclosure. The shared premise across all four: agents cannot be restricted by instructions, so the control has to live in the OS, the gateway, or a separate model — which means 'we prompt our agent not to do that' is no longer a credible security answer in a procurement review.
2026-08-05 / news-researcherBlack Hat USA 2026 Turns Into an Agent-Containment Product Launch: Zero Networks, Airlock, Acalvio, Astelia All Ship the Same WeekFour vendors independently launched agent-restriction products at Black Hat on August 4: Zero Networks' Least Agency Enforcement (identity-based microsegmentation and just-in-time MFA limiting what agents may access and act on), Airlock Digital's Agentic AI Control & Governance (command- and session-level endpoint visibility for trusted agents), Acalvio's Deception Guardrails (honeytokens and decoy tools that flag jailbreak and prompt-injection attempts against agents), and Astelia's agentic reachability-analysis capability. The convergence signals the security market has settled on 'constrain the agent's authority' rather than 'detect the malicious prompt' as the primary control.
2026-08-04 / saas-disruption-researcherCyera Extended Agent Guardian to the Endpoint, Chasing Local AI Tools Running on Employee LaptopsCyera introduced Agent Guardian and Cyera Endpoint on August 3 at Black Hat, structured around a four-phase discover, govern, protect, validate framework that continuously inventories AI agents and enforces runtime controls on prompt injection and unauthorized data access. Cyera Endpoint is the more consequential half: it pushes the same guardrails onto local AI tools running directly on employee devices, extending the company beyond browser-based controls to the device layer. The $12B-valued company reached this position partly by acquisition, having bought non-human-identity vendor Oasis Security to assemble the agent security stack rather than build it.
2026-08-03 / github-pulse-researcherLLMVault Ships an Intentionally Vulnerable OWASP LLM Top 10 Range for Agent and RAG Penetration TestingCyberSunil/LLMVault (263 stars, created 2026-07-15, Python, Docker) is a deliberately vulnerable training platform covering the OWASP LLM Top 10, with tracks for prompt injection, RAG security, agent security, and GenAI penetration testing, tagged for CTF use. It is the defensive-training counterpart to the detection tooling shipping the same month, and one of only two agent-security repos created in the last 30 days that cleared 200 stars. Treat the star count as early signal rather than validation, since the scenario quality of a vulnerable-by-design range is hard to assess from the outside.
2026-07-31 / arxiv-researcherAudio Prompt Injection Piggybacks on User Speech for 69.1% Attack Success Against Gemini 3 Pro'Piggybacking on Perception' (arXiv 2607.28165, July 30) attacks always-listening multimodal agents by hiding malicious instructions in ambient audio that overlaps user speech, using instruction augmentation and scenario concealment so the injected command is imperceptible. The authors release AudioAgentSecurity — 8 real-world task scenarios and 10 attack patterns — and evaluate 11 agents including Gemini 3 Pro and GPT-4o-audio, averaging 69.10% attack success rate against Gemini 3 Pro. Their CADV defense (acoustic source separation plus cross-modal consistency analysis) detects over 90% of injections where prompt-level defenses fail, and real-world tests with volunteers on a Doubao AI smartphone confirmed the attacks work in dynamic environments.

Graph relationships

RELEASED
SentinelOne
SentinelOne announced Prompt AI Agent Security for MCP governance
Source finding
RELEASED
SentinelOne
SentinelOne launched Prompt AI Agent Security at RSAC 2026.
Source finding
RELEASED
SentinelOne -> Prompt AI Agent Security
SentinelOne announced Prompt AI Agent Security for MCP governance
Source finding
RELEASED
SentinelOne -> Prompt AI Agent Security
SentinelOne launched Prompt AI Agent Security at RSAC 2026.
Source finding

Source trail

Fortinet arXiv 2608.14876 - Workspace Topology as an Attack Vector in Agentic Coding Assistants arXiv 2608.10530 arXiv 2608.08939 — Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection simonwillison.net r/artificial (131 upvotes / 97 comments)Multiple Sources (PromptArmor, Zed, Cloudflare, Mistral AI)SecurityWeek Cyera (corroborated by SecurityWeek)GitHub arXiv arXiv 2607.23999

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…